Analysis
- max time kernel
150s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/10/2026, 01:51
Behavioral task
behavioral1
Sample
2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target 2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe
- Size 2.6MB
- Sample261030-caa8pavvft
- SHA256 1696dab42b950c295c39e42a9d89ea0d8dcff13e49695e2feef6f7520ab21c4c
- MD5 756907cca62f67582aee5d0fff2c69a1
- SHA1 f80acee40deafbe771742a3f1b1d77739954bd43
- SHA512 8775b540a3642d89aa60ec5f7726268cbf50c2ece2a452b5454c36273efb49d0ff4b3c7557ca0f34e4857c9b9bd39c927bff007ddb89943f63c3f63761a4b6ea
- SSDEEP 49152:WTGkQy56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtS0rQMYOF:WKkVkOhCXHHFZMjHfUKkVWsM0r1F
- TLSH T173C59F31B7818036D1B7427186FA47BBA5297C211715A5CF73C87A2A1FB36D2AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detection of CryptoLocker Variants 1 IoCs
resource yara_rule behavioral1/files/0x000400000002325d-2.dat CryptoLocker_rule2 - Detection of Cryptolocker Samples 1 IoCs
resource yara_rule behavioral1/files/0x000400000002325d-2.dat CryptoLocker_set1 - UPX dump on OEP (original entry point) 16 IoCs
resource yara_rule behavioral1/memory/880-0-0x0000000000170000-0x00000000001F9000-memory.dmp UPX behavioral1/files/0x000400000002325d-2.dat UPX behavioral1/memory/4832-4-0x0000000000FF0000-0x0000000001079000-memory.dmp UPX behavioral1/memory/880-18-0x0000000000170000-0x00000000001F9000-memory.dmp UPX behavioral1/memory/4832-20-0x0000000000FF0000-0x0000000001079000-memory.dmp UPX behavioral1/memory/4832-21-0x0000000000FF0000-0x0000000001079000-memory.dmp UPX behavioral1/memory/4832-27-0x0000000000FF0000-0x0000000001079000-memory.dmp UPX behavioral1/memory/880-40-0x0000000000170000-0x00000000001F9000-memory.dmp UPX behavioral1/memory/4832-41-0x0000000000FF0000-0x0000000001079000-memory.dmp UPX behavioral1/memory/880-44-0x0000000000170000-0x00000000001F9000-memory.dmp UPX behavioral1/memory/880-50-0x0000000000170000-0x00000000001F9000-memory.dmp UPX behavioral1/memory/4832-51-0x0000000000FF0000-0x0000000001079000-memory.dmp UPX behavioral1/memory/4832-52-0x0000000000FF0000-0x0000000001079000-memory.dmp UPX behavioral1/memory/880-59-0x0000000000170000-0x00000000001F9000-memory.dmp UPX behavioral1/memory/880-63-0x0000000000170000-0x00000000001F9000-memory.dmp UPX behavioral1/memory/880-70-0x0000000000170000-0x00000000001F9000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 4832 c6ca30b8 - Unexpected DNS network traffic destination 28 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 47 223.5.5.5 880 2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 185 223.5.5.5 880 2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 369 114.114.114.114 880 2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 370 223.5.5.5 880 2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 578 114.114.114.114 880 2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 671 223.5.5.5 880 2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 113 223.5.5.5 880 2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 184 114.114.114.114 880 2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 218 223.5.5.5 880 2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 422 114.114.114.114 880 2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 453 114.114.114.114 880 2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 454 223.5.5.5 880 2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 609 114.114.114.114 880 2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 5 114.114.114.114 880 2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 112 114.114.114.114 4832 c6ca30b8 Destination IP 279 223.5.5.5 880 2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 328 114.114.114.114 880 2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 423 223.5.5.5 880 2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 518 114.114.114.114 880 2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 519 223.5.5.5 880 2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 579 223.5.5.5 880 2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 46 114.114.114.114 880 2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 217 114.114.114.114 880 2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 278 114.114.114.114 880 2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 331 223.5.5.5 880 2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 610 223.5.5.5 880 2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 670 114.114.114.114 880 2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 6 223.5.5.5 880 2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 c6ca30b8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content c6ca30b8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 c6ca30b8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 c6ca30b8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 c6ca30b8 File created C:\Windows\SysWOW64\c6ca30b8 2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE c6ca30b8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies c6ca30b8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 c6ca30b8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData c6ca30b8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 c6ca30b8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft c6ca30b8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache c6ca30b8 -
resource yara_rule behavioral1/memory/880-0-0x0000000000170000-0x00000000001F9000-memory.dmp upx behavioral1/files/0x000400000002325d-2.dat upx behavioral1/memory/4832-4-0x0000000000FF0000-0x0000000001079000-memory.dmp upx behavioral1/memory/880-18-0x0000000000170000-0x00000000001F9000-memory.dmp upx behavioral1/memory/4832-20-0x0000000000FF0000-0x0000000001079000-memory.dmp upx behavioral1/memory/4832-21-0x0000000000FF0000-0x0000000001079000-memory.dmp upx behavioral1/memory/4832-27-0x0000000000FF0000-0x0000000001079000-memory.dmp upx behavioral1/memory/880-40-0x0000000000170000-0x00000000001F9000-memory.dmp upx behavioral1/memory/4832-41-0x0000000000FF0000-0x0000000001079000-memory.dmp upx behavioral1/memory/880-44-0x0000000000170000-0x00000000001F9000-memory.dmp upx behavioral1/memory/880-50-0x0000000000170000-0x00000000001F9000-memory.dmp upx behavioral1/memory/4832-51-0x0000000000FF0000-0x0000000001079000-memory.dmp upx behavioral1/memory/4832-52-0x0000000000FF0000-0x0000000001079000-memory.dmp upx behavioral1/memory/880-59-0x0000000000170000-0x00000000001F9000-memory.dmp upx behavioral1/memory/880-63-0x0000000000170000-0x00000000001F9000-memory.dmp upx behavioral1/memory/880-70-0x0000000000170000-0x00000000001F9000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\52b9c0 c6ca30b8 File opened for modification C:\Windows\f10e0 2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname c6ca30b8 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain c6ca30b8 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c6ca30b8 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" c6ca30b8 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ c6ca30b8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" c6ca30b8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" c6ca30b8 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing c6ca30b8 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" c6ca30b8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" c6ca30b8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" c6ca30b8 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix c6ca30b8 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 4832 c6ca30b8 4832 c6ca30b8 4832 c6ca30b8 4832 c6ca30b8 4832 c6ca30b8 4832 c6ca30b8 4832 c6ca30b8 4832 c6ca30b8 880 2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe 880 2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe 880 2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe 880 2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe 880 2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe 880 2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 880 2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Token: SeTcbPrivilege 880 2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Token: SeDebugPrivilege 4832 c6ca30b8 Token: SeTcbPrivilege 4832 c6ca30b8
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-28_756907cca62f67582aee5d0fff2c69a1_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:880
-
C:\Windows\Syswow64\c6ca30b8C:\Windows\Syswow64\c6ca30b81⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4832
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\c6ca30b8
- Size 2.6MB
- SHA256 14b167a98331684a65d7557b6b094ee9aae5cd19edc3aa8a0598757348928972
- MD5 66d156751d92c3f6509d851fa902b1ad
- SHA1 4e25656c3f8adbc4b96ee0fa844b62da779c518c
- SHA512 83e3199f14ce39df285f7668a3c18d5db5f215ce3f053cf69aee392d2c3d741e81e6f1a078caa90676e3849ba72bc1fa2ad4dee2f8fb60f00d2caed78a6548db
- SSDEEP 49152:UTGkQy56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtS0rQMYOF:UKkVkOhCXHHFZMjHfUKkVWsM0r1F
- TLSH T13BC59F31B7818036D1B7427186FA47BBA5297C211715A5CF73C87A2A1FB36D2AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH